@wtfalch/foundry 0.34.0 → 0.35.1

package/dist/plan/own-diff.js

@@ -4,8 +4,9 @@ import { SFU_SLOT_MAX, ownsServices } from '../org.js';
 import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
 import { brokerEntryAppliedScopeKey } from './broker-entries.js';
 import { ZITADEL_FILES_PROJECT_SCOPE_KEY } from './core-files.js';
-import { ownAuthApplied } from './login-host.js';
-import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY } from './mail-relay.js';
+import { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, ownAuthApplied } from './login-host.js';
+import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_BASE, OWN_MAIL_SMTP_PORT_SCOPE_KEY, isOwnMailSmtpPort, } from './mail-relay.js';
+import { ownHostnames } from './own-hostnames.js';
 import { OWN_FILES_R2_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget, } from './own-services.js';
 import { OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY, OWN_SFU_APPLIED_SLOT_SCOPE_KEY, OWN_SFU_APPLIED_VERSION_SCOPE_KEY, OWN_SFU_DEPLOY_PENDING_SCOPE_KEY, OWN_SFU_KEYS_UNDELIVERED_SCOPE_KEY, SFU_INTERNAL_URL_SCOPE_KEY, SFU_PUBLIC_URL_SCOPE_KEY, } from './own-sfu.js';
 import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
@@ -21,13 +22,10 @@ export const OWN_JOBS_BLOCKED_KEY = 'own-jobs';
  * blocked line is fixed text: it is part of the stale-plan comparison.
  */
 export function planOwnJobs(options) {
-    const { org, recordedIds, readiness, isPlatformOrg, ownServices } = options;
+    const { org, recordedIds, readiness, ownServices } = options;
     if (!ownsServices(org))
         return { step: null, blocked: null };
     const blocked = (line) => ({ step: null, blocked: line });
-    if (isPlatformOrg) {
-        return blocked(`${org.slug} cannot run its own services: it is the platform's own org`);
-    }
     const undelivered = recordedIds[JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY];
     if (undelivered && !options.tokenHeld) {
         return blocked(`${org.slug}'s own jobs scheduler admin token for app ${undelivered} was minted but not confirmed delivered; remove the recorded key ${JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY} to mint a new one`);
@@ -66,8 +64,7 @@ export function planOwnJobs(options) {
 const BROKER_ENTRY_APPLIED_PREFIX = brokerEntryAppliedScopeKey('');
 /** `unmanaged` key of the one line `planOwnAuth` reports. */
 export const OWN_AUTH_BLOCKED_KEY = 'own-auth';
-/** The hostname an own org's sign-in last applied at, so a changed domain plans the step again. */
-export const OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY = 'own_auth_applied_hostname';
+export { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY };
 /** The auth git ref an own org's sign-in last deployed, so a changed declared ref plans the step again. */
 export const OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY = 'own_auth_applied_git_ref';
 /**
@@ -80,14 +77,18 @@ export const OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY = 'own_auth_applied_git_ref';
  * text: it is part of the stale-plan comparison.
  */
 export function planOwnAuth(options) {
-    const { org, recordedIds, readiness, isPlatformOrg, ownServices } = options;
-    // `planOwnJobs` reports the platform's own org once.
-    if (!ownsServices(org) || isPlatformOrg || !org.domain)
+    const { org, recordedIds, readiness, ownServices } = options;
+    if (!ownsServices(org))
         return { step: null, blocked: null };
     const blocked = (reason) => ({
         step: null,
         blocked: `${org.slug}'s own sign-in is blocked, not planned: ${reason}`,
     });
+    // The owner's sign-in takes the apex's `auth.` name. An old shared sign-in still recorded there
+    // would be repointed at a new empty one, and every operator locked out.
+    if (readiness.platformAuthRecordedHost && readiness.platformOwnerOrgId === org.id) {
+        return blocked(`the platform's shared sign-in is still recorded at ${readiness.platformAuthRecordedHost}; this build is for a platform built from empty`);
+    }
     if (recordedIds.zitadel_org && !recordedIds[OWN_SERVICES_APPLIED_SCOPE_KEY]) {
         return {
             step: null,
@@ -113,8 +114,11 @@ export function planOwnAuth(options) {
     const gitRef = readiness.serviceGitRefs?.auth;
     if (!gitRef)
         return blocked('the platform declares no auth git ref');
-    if (!options.zone?.active)
-        return blocked(`the zone for ${org.domain} is not active yet`);
+    const names = ownHostnames(org);
+    // A company without a domain has no zone of its own: it waits for the `oikos.host` zone at the platform's edge.
+    const zoneActive = org.domain ? Boolean(options.zone?.active) : Boolean(options.oikosZoneReady);
+    if (!zoneActive)
+        return blocked(`the zone for ${names.zone} is not active yet`);
     const ownEdge = readiness.ownEdgePorts;
     if (readiness.dnsBlocked && !(ownEdge?.dns && ownEdge.tunnels)) {
         return blocked(readiness.dnsBlocked);
@@ -125,10 +129,14 @@ export function planOwnAuth(options) {
     if (!options.mailKeyHeld && !options.mailKeyMintable) {
         return blocked(`the held key ${orgTarget(org).refs.brokerMailKey} is not held yet`);
     }
-    const hostname = `auth.${org.domain}`;
+    const hostname = names.auth;
     // The broker starts only on a valid `AUTH_APPS`, and the login client is minted only once it does:
     // the first broker entry is what lets this step finish, as the platform's first registration does.
-    const brokerHoldsAnEntry = Object.keys(recordedIds).some((key) => key.startsWith(BROKER_ENTRY_APPLIED_PREFIX));
+    // Archon's registration is an entry too; the platform records it, not this org, so it comes in
+    // through the readiness.
+    const brokerAppId = recordedIds[PLATFORM_AUTH_BROKER_SCOPE_KEY];
+    const brokerHoldsAnEntry = Object.keys(recordedIds).some((key) => key.startsWith(BROKER_ENTRY_APPLIED_PREFIX)) ||
+        (Boolean(brokerAppId) && readiness.archonBrokerAppId === brokerAppId);
     const applied = Boolean(recordedIds[`coolify:own-auth:${org.id}`]) &&
         Boolean(recordedIds[OWN_SERVICES_APPLIED_SCOPE_KEY]);
     if (applied &&
@@ -171,8 +179,8 @@ export const OWN_MAIL_BLOCKED_KEY = 'own-mail';
  * stale-plan comparison.
  */
 export function planOwnMail(options) {
-    const { org, recordedIds, readiness, isPlatformOrg, ownServices, mailRelayApplied, zoneActive } = options;
-    if (!ownsServices(org) || org.mail.mode === 'off' || isPlatformOrg) {
+    const { org, recordedIds, readiness, ownServices, mailRelayApplied, zoneActive } = options;
+    if (!ownsServices(org) || org.mail.mode === 'off') {
         return { step: null, blocked: null };
     }
     const blocked = (reason) => ({
@@ -191,8 +199,6 @@ export function planOwnMail(options) {
     const floating = floatingTagBlocked('Stalwart', gitRef, 'v0.16.24');
     if (floating)
         return blocked(`${floating} as the mail gitRef`);
-    if (!org.domain)
-        return blocked('the org declares no domain');
     if (!ownAuthApplied(org, recordedIds)) {
         return blocked('its own sign-in is not applied yet');
     }
@@ -200,10 +206,14 @@ export function planOwnMail(options) {
         return blocked('the shared mail relay is not applied yet');
     }
     if (!zoneActive)
-        return blocked(`the zone for ${org.domain} is not active yet`);
+        return blocked(`the zone for ${ownHostnames(org).zone} is not active yet`);
     const platformApex = readiness.platformApex;
-    const hostname = `mail.${org.domain}`;
+    const hostname = ownHostnames(org).mail;
+    const smtpPort = options.smtpPort ?? OWN_MAIL_SMTP_PORT_BASE;
+    if (!isOwnMailSmtpPort(smtpPort))
+        return blocked('its mail port is outside the range foundry uses');
     if (recordedIds[`coolify:own-mail:${org.id}`] &&
+        recordedIds[OWN_MAIL_SMTP_PORT_SCOPE_KEY] === String(smtpPort) &&
         recordedIds[PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY] === hostname &&
         recordedIds[PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY] === gitRef &&
         recordedIds[PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY] &&
@@ -217,7 +227,7 @@ export function planOwnMail(options) {
                 system: 'coolify',
                 kind: 'own-mail',
                 key: org.id,
-                desired: { hostname, gitRef, mailHost: platformMailMxHost(platformApex) },
+                desired: { hostname, gitRef, mailHost: platformMailMxHost(platformApex), smtpPort },
             },
             step: {
                 description: `provision ${org.slug}'s own mail server`,
@@ -240,10 +250,9 @@ export const OWN_SFU_FIREWALL_KEY = 'own-sfu:firewall';
  * Every line is fixed text: it is part of the stale-plan comparison.
  */
 export function planOwnSfu(options) {
-    const { org, recordedIds, isPlatformOrg, ownServices, zoneActive, sfuPortsOpen, readiness } = options;
+    const { org, recordedIds, ownServices, zoneActive, sfuPortsOpen, readiness } = options;
     const none = { step: null, blocked: null, firewall: null };
-    // The platform's own org is reported once, by `planOwnJobs`.
-    if (!ownsServices(org) || !org.calls.enabled || isPlatformOrg || !org.domain)
+    if (!ownsServices(org) || !org.calls.enabled)
         return none;
     const blocked = (line) => ({ ...none, blocked: line });
     const slot = org.services?.sfuSlot;
@@ -270,7 +279,7 @@ export function planOwnSfu(options) {
     if (!ownAuthApplied(org, recordedIds))
         return waiting('its own sign-in is not applied yet');
     if (!zoneActive)
-        return waiting(`the zone for ${org.domain} is not active yet`);
+        return waiting(`the zone for ${ownHostnames(org).zone} is not active yet`);
     const ownEdge = readiness.ownEdgePorts;
     if (readiness.dnsBlocked && !(ownEdge?.dns && ownEdge.tunnels)) {
         return waiting(readiness.dnsBlocked);
@@ -278,8 +287,8 @@ export function planOwnSfu(options) {
     if (!ownEdge?.tunnels && !readiness.edgeReady) {
         return waiting('the host supplies no tunnel port and edge is not ready');
     }
-    const hostname = `sfu.${org.domain}`;
-    const version = VERSIONS.livekit;
+    const hostname = ownHostnames(org).sfu;
+    const version = org.versionPin?.sfu ?? VERSIONS.livekit;
     const applied = Boolean(recordedIds[`coolify:own-sfu:${org.id}`]) &&
         recordedIds[OWN_SFU_APPLIED_VERSION_SCOPE_KEY] === version &&
         recordedIds[OWN_SFU_APPLIED_SLOT_SCOPE_KEY] === String(slot) &&
@@ -315,9 +324,8 @@ export const OWN_FILES_BLOCKED_KEY = 'own-files';
  * comparison.
  */
 export function planOwnFiles(options) {
-    const { org, recordedIds, readiness, isPlatformOrg, ownServices, filesDeps } = options;
-    // `planOwnJobs` reports the platform's own org once.
-    if (!ownsServices(org) || isPlatformOrg || !org.domain)
+    const { org, recordedIds, readiness, ownServices, filesDeps } = options;
+    if (!ownsServices(org))
         return { step: null, blocked: null };
     const blocked = (reason) => ({
         step: null,
@@ -345,7 +353,7 @@ export function planOwnFiles(options) {
     }
     if (!filesDeps.bucket)
         return blocked('the host supplies no bucket port');
-    const hostname = `files.${org.domain}`;
+    const hostname = ownHostnames(org).files;
     const applied = Boolean(recordedIds[`coolify:own-files:${org.id}`]);
     if (applied &&
         recordedIds[PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY] === hostname &&
@@ -393,8 +401,8 @@ export const OWN_FILES_R2_BLOCKED_KEY = 'own-files-r2';
  * does not block the step: the next run deletes it first. The blocked line is fixed text.
  */
 export function planOwnFilesR2(options) {
-    const { org, recordedIds, isPlatformOrg, ownServices, ports } = options;
-    if (!ownsServices(org) || isPlatformOrg || !org.domain || !ownServices) {
+    const { org, recordedIds, ownServices, ports } = options;
+    if (!ownsServices(org) || !ownServices) {
         return { step: null, blocked: null };
     }
     if (!recordedIds[`coolify:own-files:${org.id}`])

package/dist/plan/own-hostnames.d.ts

@@ -0,0 +1,27 @@
+import type { DeclaredOrg } from '../org.js';
+/** The zone a company without a domain of its own runs its services on. */
+export declare const NO_DOMAIN_ZONE = "oikos.host";
+/** Every hostname an own company's services answer on. */
+export interface OwnHostnames {
+    /** `org.domain`, or {@link NO_DOMAIN_ZONE} for a company without one. */
+    zone: string;
+    /** `auth.<domain>`, or `<slug>-auth.oikos.host`. */
+    auth: string;
+    /** `mail.<domain>`, or `<slug>-mail.oikos.host`. */
+    mail: string;
+    /** `files.<domain>`, or `<slug>-files.oikos.host`. */
+    files: string;
+    /** `sfu.<domain>`, or `<slug>-sfu.oikos.host`. */
+    sfu: string;
+    /** `https://<auth>`. */
+    issuerUrl: string;
+    /** The mail domain: `<domain>`, or `<slug>.oikos.host` (names are `name@<slug>.oikos.host`). */
+    mailDomain: string;
+}
+/**
+ * The one place that decides every own-service hostname. A company with a
+ * domain (and the matching `usesDomain` for the issuer and for mail) runs on
+ * it; a company without one runs on `oikos.host`. `auth` is
+ * {@link loginHostnameFor}, so the two cannot disagree.
+ */
+export declare function ownHostnames(org: Pick<DeclaredOrg, 'slug' | 'domain' | 'issuer' | 'mail'>): OwnHostnames;

package/dist/plan/own-hostnames.js

@@ -0,0 +1,24 @@
+import { loginHostnameFor } from './login-host.js';
+/** The zone a company without a domain of its own runs its services on. */
+export const NO_DOMAIN_ZONE = 'oikos.host';
+/**
+ * The one place that decides every own-service hostname. A company with a
+ * domain (and the matching `usesDomain` for the issuer and for mail) runs on
+ * it; a company without one runs on `oikos.host`. `auth` is
+ * {@link loginHostnameFor}, so the two cannot disagree.
+ */
+export function ownHostnames(org) {
+    const { slug, domain } = org;
+    const auth = loginHostnameFor(org);
+    const name = (label) => domain ? `${label}.${domain}` : `${slug}-${label}.${NO_DOMAIN_ZONE}`;
+    const mailOnDomain = Boolean(domain) && org.mail.usesDomain;
+    return {
+        zone: domain ?? NO_DOMAIN_ZONE,
+        auth,
+        mail: mailOnDomain ? `mail.${domain}` : `${slug}-mail.${NO_DOMAIN_ZONE}`,
+        files: name('files'),
+        sfu: name('sfu'),
+        issuerUrl: `https://${auth}`,
+        mailDomain: mailOnDomain && domain ? domain : `${slug}.${NO_DOMAIN_ZONE}`,
+    };
+}

package/dist/plan/own-limits.d.ts

@@ -1,22 +1,213 @@
 import type { CoolifyPort } from './executor.js';
+import { type CapabilityTier } from './run-options.js';
 /**
- * The hard limits every container of a company that runs its own services
- * gets: one flat default. Field names are Coolify's (`PATCH /applications/{uuid}`
+ * The hard limits of every container foundry creates, per step (`LIMITS`). Field names are Coolify's (`PATCH /applications/{uuid}`
  * and `PATCH /databases/{uuid}`: `limits_memory`, `limits_cpus`). Coolify has
  * no field for a process limit, and its `custom_docker_run_options` parser drops
  * `--pids-limit`, so 512 processes cannot be set through Coolify.
  */
 export declare const OWN_LIMITS_MEMORY = "1g";
 export declare const OWN_LIMITS_CPUS = "1";
+/**
+ * What a step's containers get. `memory` is for applications, `dbMemory` for
+ * databases. `autoDeploy: false` makes every git application the step creates
+ * or updates deploy only when foundry deploys it; `'declared'` leaves it to
+ * the company's own hosting entry (`HostingEntry.autoDeploy`).
+ */
+export interface LimitProfile {
+    memory: string;
+    dbMemory: string;
+    autoDeploy: false | 'declared';
+    /** The capability options sent in `custom_docker_run_options` (`plan/run-options.ts`). */
+    capabilities: CapabilityTier;
+}
+/**
+ * The one table of memory limits, per step. Every container foundry creates
+ * is in a step named here. The five `own*` rows are the flat 1g the own
+ * services already ran with. A Node or Next app gets 1g, a small Postgres
+ * 512m, the Go-sized helpers (relay, boule, edge, hc) less.
+ */
+export declare const LIMITS: {
+    readonly ownAuth: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly ownJobs: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly ownFiles: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly ownMail: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly ownSfu: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    /** A customer's hosting entry: capability tier B, unless the entry declares `capabilities: 'standard'`. */
+    readonly companyApp: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly companyAppStandard: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly brokerEntry: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly cms: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly chat: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly calls: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly agora: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly boule: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly companyOther: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformArchon: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformAi: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformIntegrations: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformMailRelay: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformIngress: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly connector: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformFiles: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformEdge: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformHc: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformMail: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformAuth: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+    readonly platformJobs: {
+        memory: string;
+        dbMemory: string;
+        autoDeploy: false | "declared";
+        capabilities: CapabilityTier;
+    };
+};
 /** The same bound the neighbouring Coolify calls in this package use for a call that may hang. */
 export declare const OWN_LIMITS_TIMEOUT_MS = 60000;
 type LimitsPort = Partial<Pick<CoolifyPort, 'createGithubAppApplication' | 'createDockerImageApplication' | 'createDockerfileApplication' | 'createPostgresDatabase' | 'findApplicationByName' | 'getApplication' | 'getDatabase' | 'updateApplication' | 'raw'>>;
 /**
- * The Coolify port an own-services step uses, with the limits set on every
+ * The Coolify port a step uses, with the profile's memory limit set on every
  * application and database it creates, and set again on one it finds without
- * them, so a company provisioned before the limits existed converges on its
- * next apply. A failed limits call fails the calling step before it records
- * its applied marker; the next run finds the resource and sets them.
+ * it, so a company provisioned before the limits existed converges on its
+ * next apply. With `autoDeploy: false` a git application is created with
+ * auto-deploy off, and one found or updated with it on is switched off. A
+ * failed limits call fails the calling step before it records its applied
+ * marker; the next run finds the resource and sets them.
+ *
+ * `scope` is a profile, or a function that gives the profile of the step now
+ * running (none: the port is used as it is).
+ *
+ * Every limits call has a 60 second timeout. A step that creates a resource
+ * and then fails on the limits call leaves a resource without limits; the
+ * next run finds it by name and sets them.
  */
-export declare function limited<C extends LimitsPort>(coolify: C): C;
+export declare function limited<C extends LimitsPort>(coolify: C, scope?: LimitProfile | (() => LimitProfile | undefined)): C;
+/** The deps of a step with their Coolify port limited by `profile`. */
+export declare function limitedDeps<D extends {
+    coolify: LimitsPort;
+}>(deps: D, profile: LimitProfile): D;
 export {};